From 9dde7d8de047b55ec636c4c7cba89ec95324d492 Mon Sep 17 00:00:00 2001 From: Gannon McGibbon Date: Thu, 8 Nov 2018 14:45:06 -0500 Subject: Ensure external redirects are explicitly allowed Add `fallback_location` and `allow_other_host` options to `redirect_to`. --- actionpack/test/controller/action_pack_assertions_test.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'actionpack/test/controller/action_pack_assertions_test.rb') diff --git a/actionpack/test/controller/action_pack_assertions_test.rb b/actionpack/test/controller/action_pack_assertions_test.rb index ecb8c37e6b..c7aae034dd 100644 --- a/actionpack/test/controller/action_pack_assertions_test.rb +++ b/actionpack/test/controller/action_pack_assertions_test.rb @@ -28,13 +28,13 @@ class ActionPackAssertionsController < ActionController::Base def redirect_to_path() redirect_to "/some/path" end - def redirect_invalid_external_route() redirect_to "ht_tp://www.rubyonrails.org" end + def redirect_invalid_external_route() redirect_to "ht_tp://www.rubyonrails.org", allow_other_host: true end def redirect_to_named_route() redirect_to route_one_url end - def redirect_external() redirect_to "http://www.rubyonrails.org"; end + def redirect_external() redirect_to "http://www.rubyonrails.org", allow_other_host: true; end - def redirect_external_protocol_relative() redirect_to "//www.rubyonrails.org"; end + def redirect_external_protocol_relative() redirect_to "//www.rubyonrails.org", allow_other_host: true; end def response404() head "404 AWOL" end -- cgit v1.2.3